matz/knu: Requesting committer privileges to add Win32 NTLM authentication to net/http

Matz, Mr. Musha, and All,

I authored a library [1] a few months ago that gives the net/http module the
ability to use NTLM to authenticate as the current user. This capability is
most useful in corporate environments that have installed Microsoft's ISA
proxy, which authenticates all web traffic. For example, it allows the "gem"
commands to work [2]. The library is available as a gem now, and has been
used successfully by at least a handful of people. Searching for RubySSPI
will turn up a few blogs and emails to ruby-talk.

Prior to this module, people had to use a proxy-proxy (such as APS [3],
which is written in Python!). Even the proxy-proxy required that you type in
a username and password. My module integrates with Microsoft's SSPI API and
authenticates just like Internet Explorer or Firefox - as the current user
w/ no username or password required.

I got in touch with Minero Aoki recently, and he would like to integrate
this ability into net/http. He suggests I maintain the NTLM portion, which
is why I am writing this list. Below you will see his message and his
suggestions.

I would like to update my library according to his suggestions (adding the
cygwin and mingw platform support and renaming modules slightly), and then
get it into the Ruby trunk as soon as possible.

Please let me know what you need from me to proceed, or if you have
concerns. BTW, I have released several gems if you wish to check out the
kind of code I write[4].

Thanks!

Justin

[1] RubySSPI - http://rubyforge.org/projects/rubysspi/
[2] InfoQ did a write up on the benefits of the library at
http://www.infoq.com/news/2006/11/rubysspi-gem-released
[3] http://www.geocities.com/rozmanov/ntlm/ - the sourceforge link appears
to be gone :(
[4] http://rubyforge.org/users/m4dc4p/

---------- Forwarded message ----------
From: Minero Aoki < [e-mail]>
Date: Feb 14, 2007 4:03 AM
Subject: Re: RubySSPI & Win32 NTLM authentication in net/http
To: Justin Bailey < [e-mail]>

Hello Justin,

Thank you very much for your contact.  And sorry that I did not respond
to your mail, I was too busy with my final exam of university.

On 2007/02/14, at 1:56, Justin Bailey wrote:

> I hope you don't mind me emailing you directly. I developed a library
> for Win32 which integrates with Windows and gives HTTP requests
> support for NTLM authentication, based on the current user's identity.
> I created it because my ruby scripts started failing when my company
> installed an authenticating proxy and I couldn't live without them  :)
>
> Anyways, I received an email from the person below, pointing out that
> you had looked at my library and wanted to integrate, but there were
> some problems with it. I probably missed those posts because I can't
> read Japanese :)
>
> If you are interested in bringing it into net/http I would love to
> help in any way I can, update the license as needed, or change
> whatever might make it hard to integrate into Ruby.

Yes, I'm interesting in your NTLM patch, but I have two concerns
to be resolved before merge.

1. Maintainer.
I cannot maintain sspi module itself, because I don't have NTLM
environment.  My proposal is, you or any other person becomes
core committer of ruby and maintains sspi.rb.  Of course, you don't
worry about net/http and its NTLM interface, I maintain them.

I cannot decide about maintainner issues, please negotiate
ruby-core guys.  Currently Ruby 1.9 (trunk) is owned by Matz and
Ruby 1.8.x branch is maintained by knu (Akinori Musha).  You
should commit sspi.rb in trunk (1.9) at first, then 1.8 branch.

2. SSPI module location.
In your patch, library name is net/rubysspi.  But library name
should be simply "sspi", because the main module is named
"SSPI".   Also, sspi.rb should locate under library-root directory,
instead of net directory.

Other option is win32/sspi, because SSPI module relies on
Win32API.  If you choose win32/sspi, module name also should
be Win32::SSPI.  A Library and a module name must synchronize.


There are any other concerns such as coding style or Cygwin
platform, but I think they are not important, relatively.


By the way, I thought this patch was too "friendly" at first review.
Current net/http is not friendly such as your patch, e.g. no automatic
proxy support, no automatic redirect, and more.   But now I changed
my heart.  net/http should become more friendly.  So I decide to
accept your patch.


Best Regards,
Minero Aoki